CVE-2026-89248: AVideo WebRTC Plugin Information Disclosure via status.json.php
AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 is missing an authentication/authorization check in plugin/WebRTC/status.json.php. When the WebRTC plugin is present, any unauthenticated remote user can request /plugin/WebRTC/status.json.php and receive JSON containing the absolute filesystem path of the WebRTC2RTMP helper binary (revealing the document-root path), the configured WebRTC port, fileexists/isexecutable status for the binary, the contents of the WebRTC log/JSON files (videos/WebRTC2RTMP.log) when present, and whether the configured port is reachable on loopback (127.0.0.1) and on the public address. The endpoint performs no User::isLogged(), User::isAdmin(), or forbiddenPage() check. The issue was unfixed at the time of reporting.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Any AVideo deployment with the WebRTC plugin present is exposed because the affected endpoint can be requested remotely without authentication. An attacker does not need an account or user interaction.
What information can an unauthenticated requester obtain?
The endpoint can disclose the absolute path to the WebRTC2RTMP helper binary, the configured WebRTC port, whether the binary exists and is executable, and loopback and public-address port reachability. If present, it can also return the contents of videos/WebRTC2RTMP.log and WebRTC JSON files.
How can I determine whether my deployment is affected?
Check whether the WebRTC plugin is installed and whether /plugin/WebRTC/status.json.php is reachable without logging in. A response containing WebRTC status data, paths, port information, or log content indicates exposure.
Is a fix available?
The issue was reported as unfixed. No fixed version or commit is provided in the available information.